Re: FreeBSD Security Advisory FreeBSD-SA-06:11.ipsec

On Thu, Mar 23, 2006 at 11:03:10AM +0200, Dmitry Pryanishnikov wrote:
+>
+> Hello!
+>
+> On Wed, 22 Mar 2006, FreeBSD Security Advisories wrote:
+> >II. Problem Description
+> >
+> >IPsec provides an anti-replay service which when enabled prevents an attacker
+> >from successfully executing a replay attack. This is done through the
+> >verification of sequence numbers. A programming error in the fast_ipsec(4)
+> >implementation results in the sequence number associated with a Security
+> >Association not being updated, allowing packets to unconditionally pass
+> >sequence number verification checks.
+> >
+> >III. Impact
+> >
+> >An attacker able to to intercept IPSec packets can replay them. If higher
+> >level protocols which do not provide any protection against packet replays
+> >(e.g., UDP) are used, this may have a variety of effects.
+>
+> As far as I understood, only systems which use "options FAST_IPSEC" are affected by this issue. Is it true? If so, wouldn't be wise to stress this
+> fact in the advisory?

Yes, only FAST_IPSEC and only ESP (AH is ok).

--
Pawel Jakub Dawidek http://www.wheel.pl
pjd@xxxxxxxxxxx http://www.FreeBSD.org
FreeBSD committer Am I Evil? Yes, I Am!

Attachment: pgpSylx325Rct.pgp
Description: PGP signature

Relevant Pages

  • Re: Questions re WEP encryption
    ... If all the packets were "interesting", ... I did a replay on one of my access points, ... subsequent attack on the same data set. ... An access point is a bridge, ...
    (alt.internet.wireless)
  • Re: FreeBSD Security Advisory FreeBSD-SA-06:11.ipsec
    ... On Wed, 22 Mar 2006, FreeBSD Security Advisories wrote: ... An attacker able to to intercept IPSec packets can replay them. ...
    (FreeBSD-Security)
  • Re: just an idea for packet protocol using ECB
    ... >> packets may be lost. ... I'm in favour of CTR as it requires no ... > I dont care if attackers replay packets. ... What if they replay other packets though. ...
    (sci.crypt)
  • Re: Packet capture
    ... We would like to replay these packets in order stress test a wireless ... Tcpreplay can replay capture files in the libpcap format. ...
    (comp.os.linux.networking)
  • Re: philosophy / style question: code capsuling
    ... you could reconstruct the "message boundaries" afterwards. ... I was trying to avoid having to parse through the file and to a sort algorithm of any kind to get packets in the right order when creating the new file. ... And I don't need to replay the stream, since I got a different software recording it that has replay-capability:) ...
    (comp.unix.programmer)